evolcore 0.0.33 → 0.0.35-test.0

package/dist/core/permission/session-path-grants.js

@@ -0,0 +1,334 @@
+/**
+ * session-path-grants.ts — 用户会话路径授权表
+ *
+ * 形状：路径模板 → [{ identities, access }]，identities 为角色名（owner/admin/member/visitor）。
+ *
+ * 只服务用户会话。系统会话（记忆整理等）与角色体系无关，路径边界由
+ * src/core/system-session/ 下的模块在代码里决定，不走本表、不并运行时授予。
+ *
+ * 判定规则（两条，别加第三条）：
+ *   1. 同会话多条命中 → 取最大权限（none 显式覆盖通配）
+ *   2. 与权限模式取交集：readonly 下 write 降级为 read
+ *
+ * 多表合并（mergeSessionPathGrantTables）同路径追加而非替换。
+ * 运行时动态授予（ec ctl path grant）走 grantSessionPath()，按 sessionId 持久化。
+ *
+ * 详见 docs/memory/system-session-plugin-design.md
+ */
+import fs from 'fs';
+import path from 'path';
+import { resolveRoot } from '../../paths.js';
+import { resolveProtectedCandidate, isSameOrDescendant } from './protected-paths.js';
+import { logger } from '../../utils/logger.js';
+import { registerContent, unregisterFile } from '../file-integrity/store.js';
+const ACCESS_RANK = { none: -1, read: 1, write: 2 };
+/**
+ * 内置默认授权表。当前为空：用户会话缺省只能读工作目录，
+ * 额外路径由 owner/admin 经 `ec ctl path grant` 按会话授予。
+ */
+export const BUILTIN_SESSION_PATH_GRANTS = {};
+/**
+ * 合并多张授权表：同路径模板的条目**追加**，不替换。
+ *
+ * 对象展开 `{ ...a, ...b }` 在同键时会整组丢弃前者——会话表里一旦出现同名路径，
+ * 前一张表的授予就静默消失。追加后判定仍走「同路径取最大、none 锁定」，
+ * 所以想收窄只能显式写 none，不会因为键名巧合丢权限。
+ */
+export function mergeSessionPathGrantTables(...tables) {
+    const merged = {};
+    for (const table of tables) {
+        if (!table)
+            continue;
+        for (const [template, entries] of Object.entries(table)) {
+            if (!Array.isArray(entries))
+                continue;
+            merged[template] = [...(merged[template] ?? []), ...entries];
+        }
+    }
+    return merged;
+}
+/** 判断一份授权表里的条目是否合法。 */
+export function isValidGrantEntry(entry) {
+    return Array.isArray(entry.identities)
+        && entry.identities.length > 0
+        && entry.identities.every(value => typeof value === 'string' && value.trim().length > 0)
+        && (entry.access === 'none' || entry.access === 'read' || entry.access === 'write');
+}
+/** 替换路径模板里的变量。未知变量保持原样，由调用方按「不存在」处理。 */
+export function substitutePathTemplate(template, ctx, vars) {
+    return template.replace(/\$([A-Z_]+)/g, (match, name) => vars[name] ?? match);
+}
+function buildVars(ctx) {
+    return {
+        HOME: resolveRoot(),
+        SELF_AID: ctx.selfAid,
+        PEER: ctx.peerKey,
+        OWNER: ctx.ownerAid,
+        PROJECT: ctx.projectPath,
+    };
+}
+/** 模板里出现未解析的变量时视为不可用条目。展开后的路径必须是绝对路径。 */
+function resolveTemplate(template, ctx) {
+    const resolved = substitutePathTemplate(template, ctx, buildVars(ctx));
+    const unresolved = resolved.match(/\$[A-Z_]+/g);
+    if (unresolved) {
+        // 未知变量（拼错）与已知变量缺值（如私聊会话没有 $OWNER）都会走到这里；
+        // 两者都让整条授予失效，留一行日志，否则下游只剩一个原因不明的读拒绝。
+        logger.warn(`[path-grants] 授权模板含未解析变量，条目跳过: template=${template} unresolved=${[...new Set(unresolved)].join(',')} identity=${ctx.identity ?? ''}`);
+        return undefined;
+    }
+    if (!path.isAbsolute(resolved)) {
+        logger.warn(`[path-grants] 授权模板展开后不是绝对路径，条目跳过: template=${template} resolved=${resolved}`);
+        return undefined;
+    }
+    return resolveProtectedCandidate(resolved);
+}
+/** 当前会话是否命中某条授予的身份。 */
+function identityMatches(entry, identity) {
+    const normalized = identity.trim().toLowerCase();
+    return entry.identities.some(value => value.trim().toLowerCase() === normalized);
+}
+/**
+ * 权限模式交集。系统会话不传 permissionMode，按授予原样生效。
+ * readonly 下 write 降级为 read；none 永不升级。
+ */
+function applyPermissionModeCeiling(access, permissionMode) {
+    if (access === 'none' || !permissionMode)
+        return access;
+    return permissionMode === 'readonly' ? 'read' : access;
+}
+/**
+ * 计算当前会话在给定授权表下的**有效路径集合**。
+ *
+ * 返回 path → access 的映射，只含 access 非 none 的条目。同路径多条命中取最大权限
+ * （none 除外——任一命中 none 即整体拒绝）。
+ */
+export function resolveEffectivePathGrants(table, ctx) {
+    const effective = new Map();
+    const identity = (ctx.identity ?? '').trim();
+    if (!identity)
+        return effective;
+    for (const [template, entries] of Object.entries(table)) {
+        if (!Array.isArray(entries))
+            continue;
+        const hits = entries.filter(entry => isValidGrantEntry(entry) && identityMatches(entry, identity));
+        if (hits.length === 0)
+            continue;
+        const resolved = resolveTemplate(template, ctx);
+        if (!resolved)
+            continue;
+        const previous = effective.get(resolved);
+        // none 是显式拒绝，一旦出现就锁定，不被同路径的其它授予放宽
+        if (previous === 'none')
+            continue;
+        let next = 'none';
+        for (const hit of hits) {
+            const grant = applyPermissionModeCeiling(hit.access, ctx.permissionMode);
+            if (grant === 'none') {
+                next = 'none';
+                break;
+            }
+            if (ACCESS_RANK[grant] > ACCESS_RANK[next])
+                next = grant;
+        }
+        if (next === 'none')
+            effective.set(resolved, 'none');
+        else
+            effective.set(resolved, next);
+    }
+    return effective;
+}
+/**
+ * 有效路径授权表的可读根目录列表（含只读授予）。
+ *
+ * 判定语义是「本路径落在任一可读根之下即为可读」，因此这里连同 write 授予一起返回——
+ * write 蕴含 read。
+ */
+export function resolveGrantedReadRoots(table, ctx) {
+    const roots = [];
+    for (const [value, access] of resolveEffectivePathGrants(table, ctx)) {
+        if (access === 'read' || access === 'write')
+            roots.push(value);
+    }
+    return roots;
+}
+/** 候选路径是否落在任一授权根之下（含根自身）。 */
+export function isPathGranted(candidate, roots) {
+    const resolved = resolveProtectedCandidate(candidate);
+    return roots.some(root => isSameOrDescendant(resolved, root));
+}
+const runtimeGrants = new Map();
+/**
+ * 持久化位置：$HOME/data/path/grants/<sessionId>.json —— **每会话一个文件**。
+ *
+ * 不用单个共用大文件：那样一份损坏或半写会让**所有**会话的授予一起丢，
+ * 而且清理某个会话要重写整文件。一会话一文件让隔离和回收都变成本地操作。
+ *
+ * 代价是首次加载要扫目录。授予是低频操作，目录规模等于活跃会话数，可接受。
+ */
+function runtimeGrantDir() {
+    return path.join(resolveRoot(), 'data', 'path', 'grants');
+}
+/** sessionId 形如 meta_YYYYMMDD_<epochMs>，字符集安全；仍做一次防御性收敛。 */
+function runtimeGrantFilePath(sessionId) {
+    const safe = sessionId.replace(/[^A-Za-z0-9_-]/g, '_');
+    return path.join(runtimeGrantDir(), `${safe}.json`);
+}
+/** 原子写：同目录临时文件 + rename，避免读到半写的 JSON。 */
+function persistSessionGrants(sessionId) {
+    const file = runtimeGrantFilePath(sessionId);
+    try {
+        const list = runtimeGrants.get(sessionId);
+        if (!list || list.length === 0) {
+            fs.rmSync(file, { force: true });
+            try {
+                unregisterFile(file);
+            }
+            catch { /* best-effort */ }
+            return;
+        }
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const tmp = `${file}.tmp-${process.pid}`;
+        const content = `${JSON.stringify(list, null, 2)}\n`;
+        // 先登记，再写盘：避免 CLI 进程读到"新内容 + 旧台账"的窗口
+        try {
+            registerContent(file, content);
+        }
+        catch { /* best-effort */ }
+        fs.writeFileSync(tmp, content, 'utf-8');
+        fs.renameSync(tmp, file);
+    }
+    catch { /* 持久化失败不阻断本次会话：内存授予仍然生效 */ }
+}
+let runtimeGrantsLoaded = false;
+/** 首次使用时从磁盘加载一次。单个文件损坏只影响它自己那个会话。 */
+function ensureRuntimeGrantsLoaded() {
+    if (runtimeGrantsLoaded)
+        return;
+    runtimeGrantsLoaded = true;
+    let files;
+    try {
+        files = fs.readdirSync(runtimeGrantDir()).filter(name => name.endsWith('.json'));
+    }
+    catch {
+        return; // 首次运行：目录还不存在
+    }
+    for (const name of files) {
+        const sessionId = name.slice(0, -'.json'.length);
+        try {
+            const parsed = JSON.parse(fs.readFileSync(path.join(runtimeGrantDir(), name), 'utf-8'));
+            if (Array.isArray(parsed) && parsed.length > 0)
+                runtimeGrants.set(sessionId, parsed);
+        }
+        catch { /* 该会话的授权文件损坏：跳过它，不影响其它会话 */ }
+    }
+}
+/** 供测试与重载清空（含持久化，避免下个用例读到上个用例的残留）。 */
+export function clearRuntimePathGrants(sessionId) {
+    ensureRuntimeGrantsLoaded();
+    if (sessionId) {
+        runtimeGrants.delete(sessionId);
+        persistSessionGrants(sessionId);
+        return;
+    }
+    for (const id of [...runtimeGrants.keys()]) {
+        runtimeGrants.delete(id);
+        persistSessionGrants(id);
+    }
+}
+/** 登记一条运行时授予。授权校验由 IPC 层负责（仅 owner/admin）。 */
+export function grantSessionPath(record) {
+    ensureRuntimeGrantsLoaded();
+    const list = runtimeGrants.get(record.sessionId) ?? [];
+    // 同路径同身份重复登记按覆盖处理，避免列表无限增长
+    const kept = list.filter(existing => !(existing.path === record.path && existing.identity === record.identity));
+    kept.push(record);
+    runtimeGrants.set(record.sessionId, kept);
+    persistSessionGrants(record.sessionId);
+}
+/** 撤销一条运行时授予，返回是否命中。 */
+export function revokeSessionPath(sessionId, template, identity) {
+    ensureRuntimeGrantsLoaded();
+    const list = runtimeGrants.get(sessionId);
+    if (!list)
+        return false;
+    const before = list.length;
+    const kept = list.filter(record => !(record.path === template && (identity === undefined || record.identity === identity)));
+    if (kept.length === before)
+        return false;
+    if (kept.length === 0)
+        runtimeGrants.delete(sessionId);
+    else
+        runtimeGrants.set(sessionId, kept);
+    persistSessionGrants(sessionId);
+    return true;
+}
+/** 列出某会话的运行时授予。 */
+export function listRuntimePathGrants(sessionId) {
+    ensureRuntimeGrantsLoaded();
+    return runtimeGrants.get(sessionId) ?? [];
+}
+/**
+ * 会话结束时的清理入口。
+ *
+ * 只清**该会话自己的**运行时授予：`ec ctl path grant` 是以当前会话为归属登记的，
+ * 会话结束后不再有会话身份去消费它。
+ */
+export function releaseSessionPathGrants(sessionId) {
+    ensureRuntimeGrantsLoaded();
+    if (!runtimeGrants.delete(sessionId))
+        return;
+    persistSessionGrants(sessionId);
+}
+/**
+ * 把某会话的运行时授予并入授权表。
+ *
+ * 运行时授予以**会话身份**登记：identity 缺省时表示「该会话自身」，
+ * 亦即用调用方的 identity 匹配。
+ */
+export function mergeRuntimeGrantsForSession(table, sessionId, identity) {
+    if (!sessionId)
+        return table;
+    ensureRuntimeGrantsLoaded();
+    const list = runtimeGrants.get(sessionId);
+    if (!list || list.length === 0)
+        return table;
+    const merged = { ...table };
+    for (const record of list) {
+        if (!path.isAbsolute(record.path))
+            continue;
+        if (record.identity && record.identity.trim().toLowerCase() !== identity.trim().toLowerCase())
+            continue;
+        const existing = merged[record.path];
+        merged[record.path] = [...(existing ?? []), { identities: [identity], access: record.access }];
+    }
+    return merged;
+}
+/**
+ * 会话运行目录本身恒为可读根：它是本会话私有的临时根，runner 自己的临时产物
+ * 都落在这里（见 task-context.ts 的 ensureSessionRuntimeDir）。
+ *
+ * TMPDIR 写能力另由 managedTempDir 负责，不在这里表达。
+ */
+export function sessionOwnTempReadRoot(sessionRuntimeDir) {
+    if (!sessionRuntimeDir || !path.isAbsolute(sessionRuntimeDir))
+        return [];
+    return [resolveProtectedCandidate(sessionRuntimeDir)];
+}
+/** 缺省的文件系统根：会话工作目录。 */
+export function defaultProjectRoot(projectPath) {
+    if (!projectPath || !path.isAbsolute(projectPath))
+        return [];
+    return [resolveProtectedCandidate(projectPath)];
+}
+/** 供诊断输出：当前会话的有效路径集合（含运行时授予）。 */
+export function describeEffectivePaths(table, ctx, sessionRuntimeDir) {
+    const result = [];
+    for (const [value, access] of resolveEffectivePathGrants(table, ctx)) {
+        result.push({ path: value, access });
+    }
+    for (const value of sessionOwnTempReadRoot(sessionRuntimeDir)) {
+        result.push({ path: value, access: 'read' });
+    }
+    return result;
+}

package/dist/core/permission/tool-canonical.js

@@ -0,0 +1,226 @@
+/**
+ * tool-canonical.ts — runner-agnostic canonical tool name mapping
+ *
+ * Different runners surface the same capability under different names:
+ *
+ *   canonical   ← runner aliases
+ *   ─────────────────────────────────────────────────────────────────
+ *   Bash        ← Shell (Codex), exec_command (Codex legacy)
+ *   Write       ← FileChange (new-file intent, Codex)
+ *   Edit        ← FileChange (patch intent, Codex), apply_patch (Codex)
+ *   Read        ← read_file (Codex legacy)
+ *
+ * All policy enforcement (system-session modules, evaluateToolPreflight,
+ * checkReadonly) should call canonicalToolName() once at the entry point
+ * and operate on the result, rather than handling runner-specific aliases
+ * scattered throughout.
+ *
+ * D1-A: FileChange / apply_patch require the tool input to distinguish
+ * Write vs Edit intent; the mapping function accepts an optional `input`
+ * parameter for that purpose.
+ *
+ * canonicalToolCall() goes one step further and also normalises the input:
+ * every runner's write shape (Claude/ecagent file_path, Codex fileChanges,
+ * standalone or shell-wrapped apply_patch) yields the same list of write
+ * targets, so policy modules never read runner-specific input fields.
+ */
+import { parseApplyPatchDocument, parseShellApplyPatchInvocation, } from './ec-command-parser.js';
+/**
+ * Normalise a runner-specific tool name to its canonical form.
+ *
+ * This is a projection of canonicalToolCall(): both read the same
+ * `resolveToolIntent` result, so a name-only caller can never disagree with a
+ * caller that judges operands. Pass `input` when the runner tool name alone is
+ * ambiguous (FileChange, apply_patch, and shell-carried apply_patch).
+ */
+export function canonicalToolName(toolName, input) {
+    const intent = resolveToolIntent(toolName, input);
+    switch (intent.access) {
+        case 'write':
+        case 'read':
+            return intent.name;
+        case 'shell':
+            return 'Bash';
+        default:
+            return toolName;
+    }
+}
+/**
+ * Returns true iff the canonical name represents a shell execution tool.
+ * Consolidates the ad-hoc `isShellTool` checks spread across runners.
+ */
+export function isShellToolName(toolName) {
+    const canon = canonicalToolName(toolName);
+    return canon === 'Bash';
+}
+/**
+ * Returns true iff the canonical name represents a file-write tool.
+ * Used by system-session modules and readonly checks.
+ */
+export function isWriteToolName(toolName, input) {
+    return canonicalToolCall(toolName, input).access === 'write';
+}
+// ── Internal helpers ─────────────────────────────────────────────────────────
+/**
+ * Codex FileChange intent: if fileChanges contains an apply-patch style entry
+ * (has an `oldContent` / `patch` key) it is Edit; otherwise Write.
+ */
+function resolveFileChangeName(input) {
+    if (!input)
+        return 'Write'; // conservative fallback
+    const changes = input.fileChanges;
+    if (!Array.isArray(changes) || changes.length === 0)
+        return 'Write';
+    const first = changes[0];
+    if (first && typeof first === 'object') {
+        const obj = first;
+        // A patch/edit operation carries 'patch', 'oldContent', or 'type': 'edit'
+        if ('patch' in obj || 'oldContent' in obj || obj.type === 'edit')
+            return 'Edit';
+    }
+    return 'Write';
+}
+/**
+ * apply_patch: if the patch string starts with '--- ' or 'diff ' it is an
+ * edit; otherwise (e.g. a full file replacement) treat as Write.
+ */
+function resolveApplyPatchName(input) {
+    if (!input)
+        return 'Edit'; // apply_patch is most commonly a diff edit
+    const patch = typeof input.patch === 'string' ? input.patch : '';
+    if (patch.startsWith('--- ') || patch.startsWith('diff '))
+        return 'Edit';
+    return 'Write';
+}
+const READ_TOOL_NAMES = new Set(['Read', 'Glob', 'Grep']);
+/** Keys a write tool may carry its target in (Claude / ecagent file tools). */
+const FILE_WRITE_PATH_KEYS = ['file_path', 'notebook_path', 'path'];
+/** Keys a standalone apply_patch call may carry its patch document in. */
+const APPLY_PATCH_DOCUMENT_KEYS = ['patch', 'input', 'command'];
+/** Runner tool names that mean "shell". */
+const SHELL_TOOL_NAMES = new Set(['Shell', 'exec_command']);
+/**
+ * The single place that decides what a tool call is. Every public helper here
+ * projects this result, so no two callers can classify the same call
+ * differently. `paths` is only populated for `write`; read scope stays with
+ * checkReadonly, which owns the Glob/Grep rules.
+ */
+function resolveToolIntent(toolName, input = {}) {
+    if (toolName === 'FileChange') {
+        const paths = [];
+        if (typeof input.grantRoot === 'string' && input.grantRoot)
+            paths.push(input.grantRoot);
+        collectFileChangePaths(input.fileChanges, paths);
+        return { access: 'write', name: resolveFileChangeName(input), via: 'tool', paths: unique(paths) };
+    }
+    if (toolName === 'apply_patch') {
+        return applyPatchCall(standaloneApplyPatchChanges(input), 'tool');
+    }
+    if (toolName === 'Bash' || SHELL_TOOL_NAMES.has(toolName)) {
+        const parsed = parseShellApplyPatchInvocation(input);
+        if (parsed.kind === 'file-change')
+            return applyPatchCall(parsed.fileChanges, 'shell');
+        // A recognised but malformed apply_patch is still a write attempt.
+        if (parsed.kind === 'invalid')
+            return { access: 'write', name: 'Edit', via: 'shell', paths: [] };
+        return { access: 'shell', name: 'Bash' };
+    }
+    // read_file is Codex's legacy read alias; Claude / ecagent use the name directly.
+    const name = toolName === 'read_file' ? 'Read' : toolName;
+    if (READ_TOOL_NAMES.has(name))
+        return { access: 'read', name: name };
+    if (name === 'Write' || name === 'Edit' || name === 'MultiEdit' || name === 'NotebookEdit') {
+        const paths = [];
+        for (const key of FILE_WRITE_PATH_KEYS) {
+            if (typeof input[key] === 'string' && input[key])
+                paths.push(input[key]);
+        }
+        return { access: 'write', name: name === 'Write' ? 'Write' : 'Edit', via: 'tool', paths: unique(paths) };
+    }
+    return { access: 'other', name: toolName };
+}
+export function canonicalToolCall(toolName, input = {}) {
+    return resolveToolIntent(toolName, input);
+}
+function applyPatchCall(changes, via) {
+    if (!changes || changes.length === 0)
+        return { access: 'write', name: 'Edit', via, paths: [] };
+    const name = changes.every(change => change.kind === 'add') ? 'Write' : 'Edit';
+    return { access: 'write', name, via, paths: unique(applyPatchChangePaths(changes)) };
+}
+/**
+ * A standalone apply_patch call is only accepted when every key that carries a
+ * patch document parses to the same change set; otherwise the paths approved
+ * here might not be the ones the runner applies.
+ */
+function standaloneApplyPatchChanges(input) {
+    let found;
+    let signature;
+    for (const key of APPLY_PATCH_DOCUMENT_KEYS) {
+        const value = input[key];
+        if (typeof value !== 'string' || !value.trim())
+            continue;
+        const changes = parseApplyPatchDocument(value);
+        if (!changes)
+            return undefined;
+        const next = JSON.stringify(changes);
+        if (signature !== undefined && signature !== next)
+            return undefined;
+        signature = next;
+        found = changes;
+    }
+    return found;
+}
+function unique(paths) {
+    return [...new Set(paths)];
+}
+// ── Write-target extraction shared with tool-policy ──────────────────────────
+function collectExplicitFileChangePaths(record, output) {
+    const explicitPathKeys = ['path', 'filePath', 'file_path', 'movePath', 'move_path', 'destinationPath', 'targetPath'];
+    const hasExplicitPath = explicitPathKeys.some(key => typeof record[key] === 'string');
+    for (const key of explicitPathKeys) {
+        if (typeof record[key] === 'string' && record[key])
+            output.push(record[key]);
+    }
+    if (record.kind && typeof record.kind === 'object') {
+        collectExplicitFileChangePaths(record.kind, output);
+    }
+    return hasExplicitPath;
+}
+/** Collect every target path from a Codex / Claude-style `fileChanges` payload. */
+export function collectFileChangePaths(value, output) {
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+                collectExplicitFileChangePaths(entry, output);
+            }
+        }
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    const record = value;
+    const hasExplicitPath = collectExplicitFileChangePaths(record, output);
+    // Claude-style inputs are maps keyed by path; Codex v2 uses an array of
+    // records with an explicit path field. Only treat keys as paths for the map
+    // shape so diff text and metadata never become path candidates.
+    if (!hasExplicitPath) {
+        for (const [filePath, change] of Object.entries(record)) {
+            if (filePath !== 'kind' && filePath !== 'type')
+                output.push(filePath);
+            if (change && typeof change === 'object' && !Array.isArray(change)) {
+                collectExplicitFileChangePaths(change, output);
+            }
+        }
+    }
+}
+/** Every path an apply_patch change set touches, including move destinations. */
+export function applyPatchChangePaths(changes) {
+    const paths = [];
+    for (const change of changes) {
+        paths.push(change.path);
+        if (change.movePath)
+            paths.push(change.movePath);
+    }
+    return paths;
+}